APM ClientCert to Kerberos Transition - parsing SubjectAlternateName in Variable assign

You can achieve the same result with a Variable Assign action in the Access Policy configured with the following values:

session.logon.last.domain = expr { [lindex [split [mcget {session_variable_with_user@domain}] "@"] 1] }

session.logon.last.username = expr { [lindex [split [mcget {session_variable_with_user@domain}] "@"] 0] }

In my case I wanted to populate the Username and Domain session variables from the "session.saml.last.identity" session variable which is created on the APM SAML SP after completing IdP authentication. The above syntaxes in a Variable Assign populated the Username and Domain session variables with the desired information.

• Jason